ersatztv/.gitea/workflows/renovate.yml

name: Renovate

# Self-hosted Renovate for the ErsatzTV fork (server-management#484).
#
# Opens dependency-update PRs against this repo (managers: nuget via CPM, github-actions).
# Runs on the shared Gitea act_runner (bumblebee). It supersedes the *proposing* half that
# the dependency-scan.yml (ersatztv#14) deliberately left out — that scan stays as a cheap
# in-repo detector for now.
#
# Config: repo-root renovate.json (package rules, grouping, automerge policy).
# Bot identity + tokens are injected from repo Actions secrets:
#   RENOVATE_TOKEN     — PAT of the dedicated `renovate` Gitea bot (write:repository,
#                        read:user, write:issue, read:organization)
#   GH_COM_TOKEN       — no-scope github.com PAT for changelog/release-note fetching
#                        (Renovate needs this on non-GitHub platforms; optional, degrades
#                        gracefully to anonymous if unset). Named GH_, not GITHUB_, because
#                        Gitea reserves the GITHUB_ secret-name prefix.
#
# NOTE: Gitea runs `schedule` triggers ONLY from the default branch (main); this file must
# be on main before the cron registers. Use workflow_dispatch to run on demand — it defaults
# to a DRY RUN (logs only, no PRs); dispatch with "Dry run" cleared to create real PRs.

on:
  workflow_dispatch:
    inputs:
      dryRun:
        description: 'Dry run (full = log only, no PRs; clear for a live run)'
        type: choice
        options:
          - 'full'
          - ''
        default: 'full'
      logLevel:
        description: 'Log level'
        type: choice
        options:
          - 'info'
          - 'debug'
        default: 'info'
  schedule:
    # Mondays 03:00 UTC — ahead of the 06:00 vulnerability scan
    - cron: '0 3 * * 1'

concurrency:
  group: ersatztv-renovate
  cancel-in-progress: false

# Explicit token scope (ersatztv#748) so the owner-level Actions default can move to Restricted
# (server-management#714). Declaring `permissions:` is EXHAUSTIVE, not additive: a unit omitted here
# is NOT granted, and that holds at any owner default — it is not conditional on Restricted being on.
# Only `review-verdict.yml` needs write; it declares that at the job and says why there. Full
# rationale and the per-workflow credential audit: docs/ci-cd.md -> "Workflow token scope".
# This workflow has no checkout step and never uses the injected GITEA_TOKEN for anything. Renovate's
# own branch/PR writes go through RENOVATE_TOKEN, a dedicated bot PAT the Actions default does not
# govern, and its container image comes from Docker Hub. Read-only is declared to STATE that the
# injected token is unused, not because any step needs it.
permissions:
  code: read

jobs:
  renovate:
    name: Renovate
    runs-on: ubuntu-latest
    container:
      image: renovate/renovate:43
    env:
      CI_JOB_ROLE: none
    steps:
      - name: Run Renovate
        env:
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: http://192.168.1.95:3000/api/v1
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.GH_COM_TOKEN }}
          RENOVATE_REPOSITORIES: timothy/ersatztv
          RENOVATE_AUTODISCOVER: 'false'
          RENOVATE_GIT_AUTHOR: 'Renovate Bot <renovate@tblindustries.be>'
          # Let the dockerfile manager query our HTTP-only Gitea container registry for the
          # ersatztv-ffmpeg base image. Creds (reused from the image-push secrets) + insecureRegistry
          # live here, NOT in renovate.json, so they stay out of the committed config.
          RENOVATE_HOST_RULES: '[{"matchHost":"192.168.1.95:3000","hostType":"docker","username":"${{ secrets.REGISTRY_USER }}","password":"${{ secrets.REGISTRY_PASSWORD }}","insecureRegistry":true}]'
          RENOVATE_DRY_RUN: ${{ inputs.dryRun }}
          LOG_LEVEL: ${{ inputs.logLevel || 'info' }}
        run: renovate